xml-rs chunk-boundary differential

#!/usr/bin/env python3 """ POC server for xml-rs lexer end_of_stream() state-retention bug. Serves the SAME byte sequence two ways: /chunked.svg - split across two HTTP chunks with the boundary at 'href="x/' /atomic.svg - single write A correct streaming parser must produce identical DOMs for identical bytes regardless of chunk boundaries. The Rust XML parser used by Blink (behind the XMLRustForNonXslt feature) does not: it doubles the '/', '-' or ']' character that immediately precedes a chunk boundary. """ import http.server import socketserver import time import sys PORT = 19283 # Identical payload for both endpoints. The split point is between CHUNK_A # and CHUNK_B. Note CHUNK_A ends in '/' inside an attribute value while the # parser is at depth > 0. CHUNK_A = ( b'' ) FULL = CHUNK_A + CHUNK_B POC_HTML = b""" xml-rs chunk-boundary differential

xml-rs lexer end_of_stream() chunk-boundary differential

loading...

""" class Handler(http.server.BaseHTTPRequestHandler): protocol_version = "HTTP/1.1" def _hdr(self, ctype, chunked): self.send_response(200) self.send_header("Content-Type", ctype) self.send_header("Cache-Control", "no-store") if chunked: self.send_header("Transfer-Encoding", "chunked") else: self.send_header("Content-Length", str(len(self._body))) self.end_headers() def _chunk(self, data): self.wfile.write(b"%x\r\n" % len(data)) self.wfile.write(data) self.wfile.write(b"\r\n") self.wfile.flush() def do_GET(self): if self.path.startswith("/poc.html") or self.path == "/": self._body = POC_HTML self._hdr("text/html; charset=utf-8", chunked=False) self.wfile.write(POC_HTML) return if self.path.startswith("/atomic.svg"): self._body = FULL self._hdr("image/svg+xml", chunked=False) self.wfile.write(FULL) return if self.path.startswith("/chunked.svg"): self._hdr("image/svg+xml", chunked=True) self._chunk(CHUNK_A) # Force the renderer to drain & parse the first chunk before # the second arrives, so xml_ffi::process_next_event hits # end_of_stream() in State::EmptyTagClosing. time.sleep(1.5) self._chunk(CHUNK_B) self.wfile.write(b"0\r\n\r\n") self.wfile.flush() return self.send_error(404) def log_message(self, fmt, *args): sys.stderr.write("[server] " + (fmt % args) + "\n") if __name__ == "__main__": socketserver.TCPServer.allow_reuse_address = True with socketserver.ThreadingTCPServer(("127.0.0.1", PORT), Handler) as httpd: sys.stderr.write(f"[server] listening on http://127.0.0.1:{PORT}\n") httpd.serve_forever()